Privacy Policy

1. Introduction

This Is Yarm ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our local business directory service ("Service").

By using our Service, you consent to the data practices described in this policy. If you do not agree with the practices described in this policy, please do not use our Service.

2. UK GDPR Compliance

2.1 Data Controller

This Is Yarm is the data controller responsible for your personal data. We are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about how we handle your data or wish to exercise your data protection rights, please contact us using the information provided in the "Contact Us" section below.

2.2 Lawful Bases for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. We process your data under the following lawful bases:

• Consent: When you create an account, subscribe to our communications, or opt-in to marketing emails, we process your data based on your explicit consent. You can withdraw consent at any time through your account settings or by contacting us.
• Contractual Necessity: When you use our Service, we need to process certain data to provide the service you've requested (such as creating and managing your account, processing reviews, and loyalty scheme participation).
• Legitimate Interests: We may process your data for our legitimate interests, such as improving our Service, fraud prevention, security, and internal analytics. We ensure these interests do not override your fundamental rights and freedoms.
• Legal Obligations: We may process your data to comply with legal obligations, such as responding to lawful requests from authorities.

2.3 Your Right to Complain

You have the right to lodge a complaint with the UK data protection regulator, the Information Commissioner's Office (ICO), if you believe your data protection rights have been breached:

• Website: www.ico.org.uk
• Helpline: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

3. Information We Collect

2.1 Personal Information

We may collect personal information that you voluntarily provide to us when you:

• Register for an account
• Submit a business listing
• Write a review or rating
• Contact us for support
• Subscribe to our communications

This information may include:

• Name and contact information (email address, phone number)
• Business information (business name, address, description, services)
• User-generated content (reviews, ratings, comments)
• Profile information and preferences

2.2 Automatically Collected Information

When you access our Service, we may automatically collect certain information, including:

• Device information (IP address, browser type, operating system)
• Usage data (pages visited, time spent, click patterns)
• Location data (if you enable location services)
• Cookies and similar tracking technologies

2.3 Third-Party Information

We may receive information about you from third parties, such as:

• Social media platforms (if you connect your accounts)
• Business information from public directories
• Analytics providers and advertising partners

4. How We Use Your Information

We use the information we collect for various purposes, including:

• Providing and maintaining our Service
• Processing user registrations and managing accounts
• Displaying business listings and user reviews
• Personalizing your experience and content
• Communicating with you about our Service
• Analyzing usage patterns to improve our Service
• Detecting and preventing fraud or abuse
• Complying with legal obligations
• Marketing and promotional communications (with your explicit consent)

5. Email Communications and Marketing

We comply with the Privacy and Electronic Communications Regulations (PECR) and UK GDPR when sending electronic communications.

5.1 Transactional Emails

We send essential service-related emails necessary for your account and use of our Service. These include:

• Account verification and password reset emails
• Review submission confirmations and status updates
• Loyalty scheme activity notifications
• Offer redemption confirmations
• Important Service updates and security notices

These transactional emails are necessary to provide our Service and do not require separate consent. However, you can manage your notification preferences in your account settings to control the frequency and type of service emails you receive.

5.2 Marketing Communications

We will only send you marketing emails if you have explicitly consented to receive them. Marketing communications may include:

• Newsletters about new businesses and features
• Special offers and promotions from local businesses
• Updates about This Is Yarm community events
• Surveys and feedback requests

5.3 Your Communication Preferences

You have full control over the communications you receive:

• Opt-In: During account registration, you can choose whether to receive marketing communications by ticking an opt-in box.
• Manage Preferences: You can update your email preferences at any time by logging into your account and visiting your profile settings.
• Unsubscribe: Every marketing email we send includes a clear unsubscribe link. Clicking this link will immediately opt you out of marketing communications.
• Contact Us: You can also contact us directly to update your preferences or withdraw consent for marketing communications.

Please note that even if you opt out of marketing communications, you will still receive essential transactional emails related to your account and Service usage.

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our Service:

4.1 Essential Cookies

These cookies are necessary for the Service to function properly and include:

• Authentication cookies to keep you logged in
• Security cookies to protect against fraud
• Session cookies to maintain your preferences

4.2 Analytics Tracking

We use privacy-focused analytics to understand how users interact with our Service:

• Fathom Analytics: Cookieless website usage tracking that is GDPR compliant and doesn't collect personal data
• Ahrefs Analytics: GDPR-compliant web analytics that respects user privacy and doesn't use cookies. Ahrefs Analytics is a privacy-first analytics solution that doesn't collect personally identifiable information, doesn't use tracking cookies, and fully complies with GDPR, CCPA, and other privacy regulations
• Performance monitoring to identify and fix technical issues
• User engagement metrics without personal identification

Both analytics providers we use prioritize your privacy and do not sell your data or create invasive user profiles. These tools help us improve the Service while respecting your right to privacy.

For more detailed information about our use of cookies, please see our Cookie Policy.

7. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following circumstances:

5.1 Public Information

Certain information is displayed publicly on our Service, including:

• Business listings and associated information
• User reviews and ratings (with username or initials)
• Public profile information (if you choose to make it public)

5.2 Service Providers

We may share information with trusted third-party service providers who assist us in:

• Hosting and maintaining our Service
• Privacy-focused analytics (Fathom Analytics and Ahrefs Analytics - both cookieless and GDPR compliant)
• Email communications and marketing
• Payment processing (if applicable)
• Customer support services

5.3 Legal Requirements

We may disclose your information if required by law or in response to:

• Legal process or government requests
• Protecting our rights, property, or safety
• Investigating fraud or security issues
• Enforcing our Terms & Conditions

8. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication measures
• Employee training on data protection practices

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

9. Data Retention

We retain your personal information for as long as necessary to provide our Service and fulfill the purposes outlined in this Privacy Policy. Specific retention periods include:

• Account information: Until you delete your account or request deletion
• Business listings: Until removed by the business owner or administrator
• Reviews and ratings: Indefinitely, unless removed for policy violations
• Analytics data: Anonymized usage data retained by Fathom Analytics per their privacy policy
• Legal compliance: As required by applicable laws and regulations

10. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights regarding your personal information:

• Right of Access: You can request a copy of the personal data we hold about you, free of charge in most cases.
• Right to Rectification: You can request that we correct any inaccurate or incomplete personal data.
• Right to Erasure ('Right to be Forgotten'): You can request deletion of your personal data in certain circumstances, such as when it's no longer necessary for the purpose it was collected.
• Right to Data Portability: You can request a copy of your data in a structured, commonly used, machine-readable format and transfer it to another service provider.
• Right to Object: You can object to processing of your personal data based on legitimate interests or for direct marketing purposes.
• Right to Restrict Processing: You can request that we limit the processing of your personal data in certain circumstances.
• Right to Withdraw Consent: Where we process your data based on consent, you have the right to withdraw that consent at any time.
• Right to Lodge a Complaint: You can complain to the Information Commissioner's Office (ICO) if you believe your data protection rights have been breached.

To exercise these rights, please contact us using the information provided in the "Contact Us" section. We will respond to your request within one month, though this may be extended by two further months in complex cases.

You can also manage many aspects of your data directly through your account settings, including updating your information, managing email preferences, and deleting your account.

11. Children's Privacy

Our Service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information promptly.

12. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. When we transfer your information, we ensure appropriate safeguards are in place to protect your privacy rights.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of any material changes by:

• Posting the updated policy on our website
• Sending you an email notification (if you have provided your email)
• Displaying a prominent notice on our Service

Your continued use of our Service after any changes constitutes acceptance of the updated Privacy Policy.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, our data practices, or wish to exercise your data protection rights, please contact us through the contact information provided on our website.

We will respond to your inquiry within one month in accordance with UK GDPR requirements. For complex requests, we may extend this period by a further two months and will inform you of any such extension.

Data Protection Enquiries: For specific data protection or privacy questions, please include "Data Protection Request" in your subject line to ensure your enquiry is handled promptly by the appropriate team member.